Spring Security user account registration, creation and management

Question

I've been looking into using Spring Security for the authentication/authorization of my web application (this will be JDBC based).

However, a core component seems to be left out from my perspective. How do I register/create new users? Is there an out of the box API for that?

Do i need to write user registration and management from scratch? Things i need to do include: - Registering a new user - Resetting passwords - Emailing a user to activate their account - Emailing a user to reset their account.

Thank you in advance.

Answer 1

I use Spring Security on my project. The framework does not have an API for user creation or registration as you asked. For Spring Security to be generic and usable across multiple frameworks, it can only take you so far before you have to write custom code. You can't really get a more specific answer about a framework or tool to use because at this point you will just use the frameworks you are already using anyway.

If you've set it up to use users and roles in your database, from your data access layer you would create a record in the user table or update a password (preferably stored as a hash) in that record. And as Aravind said, Spring does provide email support.

If you really want to see one way to do it: I'm using Spring MVC, JSP, and Hibernate. I use Spring's form tags in a JSP to bind a new user form to a Person object, and my controller method passes that Person object to my Dao to persist it.

The controller method signature looks like this...

@RequestMapping(value = "/newUser", method = RequestMethod.POST)
public ModelAndView createNewUser(final @Valid @ModelAttribute Person user,
                                  final BindingResult result,
                                  final SessionStatus status,
                                  final @RequestParam(value = "unencodedPassword", required = true) String password) {
        ...
        user.getRoles().add(new Role(user, Role.APPLICATION_ROLE.ROLE_USER));
        userDao.createNewUser(user);
        ...
}

and my PersonDao would use Hibernate to persist the user like so

@Transactional
public void createNewUser(Person user)
{
    Session session = sessionFactory.getCurrentSession();
    session.save(user);
    session.flush();
}